JP2019135577A - Control program, control method, and information processing device - Google Patents

Abstract

To perform backup processing even when processing which opens a file occurs despite a user's will.SOLUTION: A user terminal, when it detects processing which opens a file stored in an HDD (S12: affirmative, S14: affirmative), determines whether or not a backup of the file is needed on the basis of information (a value of a backup object of meta information) set in association with the file (S16: affirmative). Then, the user terminal, when it determines that the backup is needed, executes backup processing of the file as interruption processing (S18).SELECTED DRAWING: Figure 5

Description

  The present invention relates to a control program, a control method, and an information processing apparatus.

  A user of an information processing apparatus needs to prevent unauthorized acquisition or destruction of information (also referred to as a malignant operation) by a program or the like (hereinafter also referred to as malware) that performs a harmful operation including a computer virus.

  For example, ransomware, which is a type of malware, may be sent in a form attached to an email sent by a malicious person from the outside. Files in the device are encrypted. Then, for example, a malicious person asks the user of the information processing apparatus for a price as a condition for transferring an encryption key for decrypting the encrypted file.

  Therefore, the user of the information processing apparatus prevents damage by, for example, installing anti-virus software in the information processing apparatus in advance (see, for example, Patent Documents 1 and 2). Further, as a countermeasure against ransomware, it is known that important files are regularly backed up manually or using a tool (for example, see Non-Patent Document 1).

JP, 2015-130162, A Special table 2013-545208 gazette

"Update: Measures against ransomware whose infection is spreading", [online], Information-technology Promotion Agency, [Search January 25, 2018], Internet (URL: https: //www.ipa. go.jp/security/ciadr/vul/20170628-ransomware.html)

  However, there are new types of malware that are not supported by anti-virus software and malware that does not perform any action that anti-virus software can detect. Is not enough.

  On the other hand, when backing up an important file, there is a possibility that update information between the last backup and the encryption of the ransomware is lost. In addition, there is a possibility that the backup file is updated with the file after the ransomware encrypts.

  In one aspect, an object of the present invention is to provide a control program, a control method, and an information processing apparatus capable of performing a backup process even when a file opening process occurs in addition to the user's intention.

  In one aspect, when the control program detects a process of opening a file stored in the storage unit of the information processing device, the control program, based on the information set in association with the file type and / or the file, This is a control program that causes the information processing apparatus to execute the process of executing the file backup process as an interrupt process when it is determined whether or not backup is necessary, and when it is determined that backup is necessary.

  Backup processing can be performed even when file opening processing occurs separately from the user's intention.

It is a figure showing roughly the composition of the information processing system concerning one embodiment. It is a figure which shows the hardware constitutions of a user terminal. It is a functional block diagram of an interrupt processing unit. FIGS. 4A to 4C are diagrams illustrating file I / O access patterns that occur when ransomware encrypts a file. It is a flowchart which shows the process of an interruption process part. FIG. 6A to FIG. 6C are diagrams (No. 1) for explaining the processing of the user terminal when the ransomware encrypts the file in the user terminal. FIGS. 7A to 7C are diagrams (part 2) for explaining the processing of the user terminal when the ransomware encrypts the file in the user terminal. FIGS. 8A and 8B are diagrams (No. 3) for explaining the processing of the user terminal when the ransomware encrypts the file in the user terminal. FIGS. 9A and 9B are diagrams (No. 4) for explaining the processing of the user terminal when the ransomware encrypts the file in the user terminal.

  Hereinafter, an information processing system according to an embodiment will be described in detail with reference to FIGS.

  FIG. 1 schematically shows the configuration of the information processing system 100. The information processing system 100 includes a user terminal 10 as an information processing apparatus and a backup server 70. The user terminal 10 and the backup server 70 are connected to a network 80 such as the Internet or a LAN (Local Area Network).

  The user terminal 10 is an information processing apparatus such as a PC (Personal Computer). FIG. 2 shows the hardware configuration of the user terminal 10. As shown in FIG. 2, the user terminal 10 includes a CPU (Central Processing Unit) 90, a ROM (Read Only Memory) 92, a RAM (Random Access Memory) 94, and a storage unit (here, HDD (Hard Disk Drive)) 96. A network interface 97, a display unit 93, an input unit 95, a portable storage medium drive 99, and the like. The display unit 93 includes a liquid crystal display or the like, and the input unit 95 includes a keyboard, a mouse, or the like. Each component of the user terminal 10 is connected to a bus 98. In the user terminal 10, the CPU 90 executes a program (interrupt handler program as a control program) stored in the ROM 92 or the HDD 96 or a program read by the portable storage medium drive 99 from the portable storage medium 91. The function of the interrupt processing unit as shown in FIG. 3 is realized. Details of each function of the interrupt processing unit shown in FIG. 3 will be described later.

  Returning to FIG. 1, the backup server 70 is a server having an information storage device such as an HDD, and backs up the backup target file sent from the user terminal 10 (interrupt processing unit in FIG. 3).

  Next, each function of the interrupt processing unit of the user terminal 10 will be described with reference to FIG. The interrupt processing unit has a function of backing up an important file at an appropriate timing so that the important file is not lost due to encryption of the important file by the ransomware. As shown in FIG. 3, the interrupt processing unit functions as a system call receiving unit 20, a system call analyzing unit 22 as a detecting unit, a backup necessity determining unit 24 as a determining unit, and a backup processing unit 26 as a processing unit. Have

  When a system call such as open, read, and close is issued from the CPU 90, the system call receiving unit 20 receives the system call and passes it to the system call analyzing unit 22.

  The system call analysis unit 22 analyzes the system call received by the system call reception unit 20 and analyzes whether the system call is an open system call for a file.

  When the system call is an open system call for a file, the backup necessity determination unit 24 determines whether to back up the file.

  The backup processing unit 26 performs file backup by transmitting the file to the backup server 70 when the backup necessity determination unit 24 determines that the file is to be backed up.

(About ransomware)
Here, ransomware will be described. The ransomware may be transmitted in a form that a malicious person attaches to an email. For example, when the user terminal 10 receives an email attached with the ransomware and executes the attached ransomware, the ransomware is executed. Thus, encryption of the file in the user terminal 10 is executed. When the file encryption is executed, a message to the effect that the consideration is requested is output to the user terminal 10 as a condition for transferring the encryption key for decrypting the encrypted file. On the other hand, if the user of the user terminal 10 pays the price and the encryption key is given to the user, the file can be decrypted using the encryption key.

  File I / O access patterns generated when the ransomware encrypts a file are roughly classified into three types as shown in FIGS. 4 (a) to 4 (c).

  In the type shown in FIG. 4A, a file to be attacked is read, the file contents are encrypted, and the contents are overwritten on the file.

  In the type shown in FIG. 4B, a file to be attacked is read, the contents of the file are encrypted, and the contents are generated as a new file (after encryption). Then delete the original file.

  In the type shown in FIG. 4C, a file to be attacked is read, the contents of the file are encrypted, and the contents are generated as a new file (after encryption). Then, overwrite the file with different data and destroy it.

  In any of the types described above, as shown in FIGS. 4A to 4C, a file to be attacked is “opened” at the time of encryption.

(About interrupt processing)
Next, interrupt processing executed by the interrupt processing unit of FIG. 3 will be described with reference to the flowchart of FIG.

  In step S10, the system call receiving unit 20 waits until a system call is issued. When the system call is issued, the process proceeds to step S12.

  In step S12, the system call analysis unit 22 determines whether the issued system call is an open system call. If the issued system call is “read”, “close”, “delete”, etc., the determination in step S12 is denied and all the processes in FIG. 5 are terminated. On the other hand, if the issued system call is open, the determination in step S12 is affirmed and the process proceeds to step S14.

  In step S <b> 14, the system call analysis unit 22 determines whether the open system call access target is a file stored in the HDD 96. If the access target is not a file (for example, if it is a directory or the like), the determination in step S14 is denied, and the entire process of FIG. 5 ends. On the other hand, if the access target is a file, the determination in step S14 is affirmed and the process proceeds to step S16.

  In step S16, the backup necessity determination unit 24 determines whether the access target file is a backup target. Here, the file management meta information of the OS (Operating System) includes “file size”, “file creation date / time”, “file update date / time”, “file access date / time”, etc. In this embodiment, It is assumed that an item “backup target” (initial value is “FALSE”) is added to the meta information. Then, the user of the user terminal 10 sets “TRUE” as the value of the item “backup target” for the file to be backed up. Therefore, in step S16, the backup necessity determination unit 24 refers to the meta information of the file to be accessed by the open system call, and determines whether or not the value of the item “backup target” is “TRUE”. If the value is “FALSE”, the determination in step S16 is negative, and all the processes in FIG. 5 are terminated. On the other hand, if the value is “TRUE”, the determination in step S16 is affirmed, and the process proceeds to step S18.

  In step S18, the backup processing unit 26 transmits the file to the backup server 70 for copying (backup). In this case, the backup processing unit 26 sets, for example, “host name_IP address_host identifier (MAC address) _path name_file name_backup date (year / month / day / day). Second) ”, enabling generation management, and transmitting the file to the backup server 70, thereby backing up the file to the backup server 70. In the present embodiment, since the file name is changed every time backup is performed, a file that has already been backed up (backup file) can be backed up as another file without being updated with a new file.

  When the process of step S18 ends, the entire process of FIG. 5 ends. When all the processes in FIG. 5 are completed, the issued system call is processed. For example, if the issued system call is an open system call for a file to be backed up, the open process (file opening process) is executed after the file to be backed up is backed up. .

  Next, the process of the user terminal 10 when the ransomware encrypts the file in the user terminal 10 will be specifically described with reference to FIGS. 6 (a) to 9 (b).

  FIG. 6A schematically shows the user terminal 10 and the backup server 70. As shown in FIG. 6A, the user terminal 10 has an interrupt processing unit. As an example, two files (file 1 and file 2) are stored in the HDD 96 of the user terminal 10. It shall be. Here, it is assumed that file 1 is a backup target and file 2 is not a backup target. That is, the value of “backup target” in the meta information of file 1 is “TRUE”, and the value of “backup target” in the meta information of file 2 is “FALSE”. Further, it is assumed that the user terminal 10 is infected with ransomware.

  Assume that the ransomware issues an open system call in order to encrypt the file 1 stored in the HDD 96 as shown in FIG. 6B from the state of FIG. In this case, as shown in FIG. 6C, the interrupt processing unit receives an open system call (S12 in FIG. 5: affirmative), and as shown in FIG. 7A, whether the access target is a file or not. (S14 in FIG. 5) and whether or not the file to be accessed is a backup target (S16 in FIG. 5). In this case, since the access target (file 1) is a backup target file, the interrupt processing unit backs up the file 1 to the backup server 70 as shown in FIG. 7B (S18 in FIG. 5). This makes it possible to back up an important file immediately before being encrypted by the ransomware.

  When the processing of the interrupt processing unit is completed as described above, the open system call processing is continued, and as shown in FIG. 7C, the encryption of the file 1 by the ransomware is executed.

  On the other hand, as shown in FIG. 8A, it is assumed that the ransomware issues an open system call in order to encrypt the file 2 stored in the HDD 96. In this case, as shown in FIG. 8B, the interrupt processing unit receives the open system call (S12 in FIG. 5: affirmative), and as shown in FIG. 9A, whether or not the access target is a file. (S14 in FIG. 5) and whether or not the file to be accessed is a backup target (S16 in FIG. 5). In this case, since the file 2 is not a backup target file, the interrupt processing unit does not back up the file 2 to the backup server 70.

  When the processing of the interrupt processing unit is completed as described above, the open system call processing is continued, so that the encryption of the file 2 by ransomware is executed as shown in FIG. 9B. .

  In the present embodiment, as described above, important files that need to be restored and files that do not need to be restored (for example, OS system files) are managed separately, and only important files that need to be restored are stored in the backup server. 70 is to back up. Thereby, the backup area can be reduced and the processing amount can be reduced.

  In the present embodiment, even if an important file is encrypted by the ransomware, the important file can be restored without paying a fee to a malicious person. In order to restore an important file, for example, the OS of the user terminal 10 may be reinstalled and the file immediately before encryption may be read from the backup server 70.

  As described above in detail, according to the present embodiment, when the interrupt processing unit detects a process (open system call) for opening a file stored in the HDD 96 of the user terminal 10 (S10: affirmative, S12: affirmative). , S14: Yes), based on the “backup target” value (TRUE / FALSE) set in the meta information of the file, it is determined whether the file needs to be backed up (S16). When determining that the backup is necessary (S16: Yes), the interrupt processing unit executes the file backup process as an interrupt process (S18). By setting an important file as a backup target in this way, even if the important file is opened separately from the user's intention, that is, even when encrypted by ransomware, for example, it is important Files can be backed up before encryption. Thereby, even if an important file is encrypted, the file can be restored. In the present embodiment, since the file is backed up only when the process for opening the file to be backed up is performed, the backup area can be reduced and the amount of processing in the backup can be reduced.

  In the present embodiment, the interrupt processing unit backs up the file to be backed up to a device different from the user terminal 10 (in this embodiment, the backup server 70), so the backed up file is encrypted by the ransomware. Risk can be reduced.

  In the present embodiment, the file name of the file to be backed up is changed one by one, so that it is possible to take a backup without overwriting the file. This makes it possible to prevent an unencrypted file from being updated with the encrypted file.

  In this embodiment, even when the user himself opens the file to be backed up, the file is backed up. Therefore, even when the user does not update the file, the file is updated. Can be returned to the open state.

  In the above embodiment, the encryption process using ransomware has been described as an example in which a file is opened separately from the user's intention. However, the present invention is not limited to this. That is, in the above-described embodiment, the file can be backed up even when the file is opened separately from the user's intention by, for example, malware other than ransomware.

  In the above-described embodiment, the case has been described in which the user rewrites the meta information of the file to be backed up to distinguish the file to be backed up from the file to be backed up. However, the present invention is not limited to this. For example, you may prepare the table which defined whether it is a backup object (TRUE / FALSE) for every file. In this case, the backup necessity determination unit 24 can determine the necessity of backup by referring to the table. In the table, it may be defined for each file type whether or not it is a backup target. In this case, for example, a text file can be a backup target, and an audio file can be a backup target. In the table, for each file creator, it may be defined whether or not it is a backup target.

  Further, for example, it may be defined for each directory whether or not it is a backup target (TRUE / FALSE). In this case, the user can automatically set the important file as the backup target by storing the important file in the backup target directory.

  In the above embodiment, the case where the file is backed up to the backup server 70 has been described. However, the present invention is not limited to this, and the file may be backed up in the user terminal 10.

  In the embodiment, a plurality of user terminals 10 may share one backup server 70.

  The above processing functions can be realized by a computer. In that case, a program describing the processing contents of the functions that the processing apparatus should have is provided. By executing the program on a computer, the above processing functions are realized on the computer. The program describing the processing contents can be recorded on a computer-readable storage medium (excluding a carrier wave).

  When distributing the program, for example, the program is sold in the form of a portable storage medium such as a DVD (Digital Versatile Disc) or a CD-ROM (Compact Disc Read Only Memory) on which the program is recorded. It is also possible to store the program in a storage device of a server computer and transfer the program from the server computer to another computer via a network.

  The computer that executes the program stores, for example, the program recorded in the portable storage medium or the program transferred from the server computer in its own storage device. Then, the computer reads the program from its own storage device and executes processing according to the program. The computer can also read the program directly from the portable storage medium and execute processing according to the program. Further, each time the program is transferred from the server computer, the computer can sequentially execute processing according to the received program.

  The above-described embodiment is an example of a preferred embodiment of the present invention. However, the present invention is not limited to this, and various modifications can be made without departing from the scope of the present invention.

In addition, the following additional remarks are disclosed regarding description of the above embodiment.
(Additional remark 1) When the process which opens the file memorize | stored in the memory | storage part of information processing apparatus is detected, the said file needs to be backed up based on the information set in association with the file type and / or the file. Determine if there is,
When it is determined that backup is necessary, the file backup process is executed as an interrupt process.
A control program that causes the information processing apparatus to execute processing.
(Additional remark 2) The said backup process is a backup process to the apparatus different from the said information processing apparatus,
The control program according to supplementary note 1, wherein:
(Appendix 3) Change the file name of the backup file every time the file is backed up.
The control program according to appendix 1 or 2, characterized in that:
(Additional remark 4) When the process which opens the file memorize | stored in the memory | storage part of information processing apparatus is detected, the said file needs to be backed up based on the information set in association with the type of the file and / or the file. Determine if there is,
When it is determined that backup is necessary, the file backup process is executed as an interrupt process.
A control method, wherein the information processing apparatus executes processing.
(Additional remark 5) The detection part which detects the process which opens the file memorize | stored in the memory | storage part,
When the detection unit detects a process of opening the file, a determination unit that determines whether the file needs to be backed up based on the type of the file and / or information set in association with the file When,
A processing unit that executes the backup process of the file as an interrupt process when the determination unit determines that backup is necessary; and
An information processing apparatus comprising:
(Additional remark 6) The said process part backs up the said file to the apparatus different from the said information processing apparatus,
The information processing apparatus according to appendix 5, characterized in that:
(Appendix 7) The processing unit changes the file name of the backup file every time the file is backed up.
The information processing apparatus according to appendix 5 or 6, characterized by the above.

10 User terminal (information processing device)
22 System call analysis unit (detection unit)
24 Backup necessity judgment section (determination section)
26 Backup processing unit (processing unit)
70 Backup server (different devices)
96 HDD (storage unit)

Claims (5)

If a process for opening a file stored in the storage unit of the information processing device is detected, whether or not the file needs to be backed up based on information set in association with the type of the file and / or the file Determine
When it is determined that backup is necessary, the file backup process is executed as an interrupt process.
A control program that causes the information processing apparatus to execute processing. The backup processing is backup processing to a device different from the information processing device.
The control program according to claim 1, wherein: Rename the backup file every time you back up the file,
The control program according to claim 1 or 2, characterized by the above. If a process for opening a file stored in the storage unit of the information processing device is detected, whether or not the file needs to be backed up based on information set in association with the type of the file and / or the file Determine
When it is determined that backup is necessary, the file backup process is executed as an interrupt process.
A control method, wherein the information processing apparatus executes processing. A detection unit for detecting a process of opening a file stored in the storage unit;
When the detection unit detects a process of opening the file, a determination unit that determines whether the file needs to be backed up based on the type of the file and / or information set in association with the file When,
A processing unit that executes the backup process of the file as an interrupt process when the determination unit determines that backup is necessary; and
An information processing apparatus comprising:

Images